Privacy

Who we are

WhoSanta is operated by an individual proprietor based in the Philippines (“we”). You can reach us at contact@whosanta.com.

The promise

Only the person who drew a name can see it. The giftee never learns their Santa’s identity, not on screen, not in emails, not in exports, and not from us. Anonymous chat shows a role (“your Santa”), never a name. Our database rules enforce this, not just our screens.

What we store

• Hosts: email address, the name you choose, and the exchanges you create.
• Guests: the name you type when you join. No email or password unless you choose to add one later.
• Exchanges: event details, who joined, draw rules, wishlist items including any links and prices you add, anonymous messages between a Santa and their giftee, and the draw results.
• Payments: a record that a purchase happened, its amount and currency, and which pass or band it bought. Card details never reach us; see Payments below.
• Link clicks: when someone opens a wishlist link, we record the store’s domain and the country of the click. Not who clicked, not their address, not the full link.
• Usage: when a host sees a paid feature, starts a checkout, buys, or is refunded, so we can decide what to build and what to charge. Tied to the host’s account only.

What we use it for

Running your exchange: the draw, wishlists, chat, invitations, reminders. Sending the emails you would expect from an exchange you are part of. Taking payment for optional features. Keeping the service working and safe.

We do not sell personal data, and we do not show advertising based on it.

Who processes it for us

• Supabase hosts the database and sign-in.
• Vercel hosts the website.
• Resend sends our emails.
• Polar is our merchant of record. It handles checkout, card details, invoices and tax. Its own privacy policy applies to the checkout page.
• Slack or Microsoft, only if a host connects a channel to their exchange. We send that channel short notices such as “names are drawn”, never who drew whom.

Wishlist links and affiliates

Some wishlist links are affiliate links. When you open one we may route it through an affiliate network such as Involve Asia and earn a commission on what you buy, at no cost to you. The network sees the click; it does not learn who you are from us.

Cookies and storage

We use a sign-in cookie to keep you logged in, and your browser’s local storage for small conveniences such as your theme choice and which tab you had open. No tracking cookies, no third-party analytics scripts.

How long we keep it

Exchange data stays while the exchange exists. When a host deletes an exchange, its members, wishlists, messages and draw results are deleted with it. Guests who never add an email are tied only to the exchanges they joined. Purchase records are kept as long as tax law requires. Click and usage counts are kept in aggregate.

Your choices

• Leave an exchange before the draw from the members list.
• Ask us to delete your account and everything tied to it by emailing contact@whosanta.com from the address on the account.
• Ask us what we hold about you. We will answer within 30 days.

Children

WhoSanta is for adults organising exchanges. Children may take part in a family exchange as guests under an adult’s invitation; we do not knowingly collect emails from anyone under 16.

Changes

If this policy changes in a way that matters, we will note it here and update the date at the top. Continuing to use WhoSanta after that means you accept the change.